Collect File System (FS) Events

Overview

Evidence: Collect File System (FS) Events Description: Collect File System Events Category: DiskFilesystem Platform: macos Short Name: fsevnts Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

FSEvents maintains a journal of file system changes. This data is essential for reconstructing file activity timelines and detecting suspicious modifications.

Data Collected

This collector gathers structured data about collect file system (fs) events.

Collection Method

This collector copies entries from /System/Volumes/Data/.fseventsd/ into the case content for offline analysis.

Forensic Value

This evidence is crucial for forensic investigations as it reveals file creations, deletions, and renames even when file metadata is missing.